Computer network intrusion detection and defense system and method combined with artificial intelligence

Abstract

The invention relates to the technical field of network security, and discloses a computer network intrusion detection and defense system and method combined with artificial intelligence, and the system comprises a multi-modal data collection module which is used for collecting network flow data, host system logs, application program behavior data and other data of multiple modals, the collected data is subjected to preliminary cleaning and preprocessing, noise data and repeated data are removed, and data in different formats are converted into data in a unified processable format. By arranging the multi-modal data acquisition module and fusing the multi-modal deep learning detection model, the detection accuracy is remarkably improved by adopting the design, and compared with a traditional detection system based on a single feature library or single-dimensional analysis, the detection capability of various intrusion behaviors, especially novel unknown attacks, is greatly improved, and the detection efficiency is improved. And the adaptability of a network security protection system to a complex attack scene is comprehensively enhanced.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically to a computer network intrusion detection and defense system and method that incorporates artificial intelligence. Background Technology

[0002] With the rapid development of information technology, cybersecurity is facing increasingly severe challenges. In the field of network intrusion detection and prevention, traditional technologies are gradually revealing many limitations.

[0003] Traditional intrusion detection systems rely heavily on static signature databases. In the ever-changing cyberattack environment, new attack methods emerge constantly, while the update mechanism of signature databases lags behind. For example, according to authoritative CVE statistics, traditional detection systems have a recognition rate of less than 40% for zero-day attacks. This means that if an attack not included in the existing signature database occurs, the system will struggle to detect it, leading to significant vulnerabilities in the network security protection system and exposing the network to potential attack risks.

[0004] Regarding detection models, many existing solutions suffer from the drawback of single-dimensional analysis. Many models focus solely on network traffic analysis, neglecting the close relationship between network protocol layer load characteristics and host process behavior. In complex attack scenarios, attackers often use normal network traffic to mask malicious host process behavior. For example, an attacker might carefully construct normal network packets, hiding malicious instructions within their load, while simultaneously launching abnormal processes on the host. A single traffic analysis model simply cannot capture such complex, interconnected anomalies, leading to blind spots in the detection results.

[0005] From a response mechanism perspective, traditional Intrusion Prevention Systems (IPS) generally employ a passive response strategy, and their blocking strategies suffer from significant latency issues. According to NIST test data, the average response latency is as high as 120ms. This latency is fatal when facing Advanced Persistent Threat (APT) attack chains. APT attacks are typically meticulously planned, characterized by long durations and multiple steps. During this time, attackers can leisurely complete each attack step, stealing sensitive information or damaging the system. The passive response mechanism of traditional IPS is simply ineffective against such attacks.

[0006] In terms of resource consumption, while detection systems based on full traffic mirroring can acquire comprehensive network data, seemingly improving detection accuracy, they impose a heavy resource burden. According to RFC testing standards, such systems can cause more than 35% additional bandwidth overhead. This not only significantly increases network operating costs but also severely impacts network performance, interfering with normal business operations and creating new problems in practical applications.

[0007] For example, there's the message center system based on message push, with publication number CN112491696A. In real-world network intrusion detection and prevention scenarios, this model reveals significant shortcomings. Faced with complex, ever-changing, and constantly evolving network attacks, it lacks the crucial ability to dynamically generate defense strategies. It cannot flexibly and automatically generate and adjust corresponding defense strategies based on real-time detected threats. This limitation makes it difficult for the model to effectively respond to specific situations when facing actual network attacks, greatly reducing its flexibility and effectiveness in practical applications and failing to meet the ever-increasing demands for network security protection.

[0008] Therefore, in view of this, we will study and improve the existing structure and its shortcomings, and provide a computer network intrusion detection and defense system and method that combines artificial intelligence, in order to achieve a more practical value. Summary of the Invention

[0009] In order to overcome the above-mentioned deficiencies of the prior art, the present invention provides a computer network intrusion detection and defense system that combines artificial intelligence to solve the problems existing in the background art.

[0010] This invention provides the following technical solution: a computer network intrusion detection and prevention system combining artificial intelligence, comprising: The multimodal data acquisition module is used to collect data of various modalities such as network traffic data, host system logs, and application behavior data. It also performs preliminary cleaning and preprocessing on the collected data to remove noisy and duplicate data and convert data of different formats into a unified processable format. This paper integrates a multimodal deep learning detection model. Convolutional Neural Networks (CNNs) are used to extract traffic features from network traffic data, and Recurrent Neural Networks (RNNs) and their variant Long Short-Term Memory Networks (LSTMs) are used to model time series features from host system logs and application behavior data. A fusion mechanism is designed to combine the traffic features extracted by CNNs and the behavioral features extracted by RNNs / LSTMs. The fusion model is trained using a large amount of known normal and abnormal data, and optimization algorithms such as cross-entropy loss function and stochastic gradient descent are used to adjust the model parameters. The real-time behavior pattern evolution analysis module, based on a trained fusion multimodal deep learning detection model, monitors network behavior and host behavior in real time, tracks the evolution of behavior patterns using time series analysis technology, and automatically adjusts the parameters of the detection model based on the real-time monitored behavior patterns and early warning signals using reinforcement learning algorithms. The dynamic deception defense module automatically generates corresponding deception baits based on the type and characteristics of intrusion behavior when it detects an intrusion, constructs a virtual honeycomb environment, redirects attackers to the honeycomb, and adjusts the deception defense strategy in real time.

[0011] Furthermore, in the multimodal data acquisition module, network probes are deployed at key network nodes, with a sampling frequency of 100 data packets per second to capture network traffic data; host system log files are read periodically through the operating system log interface, and the log data is converted into a structured format using a script program; data acquisition code is embedded in the application to collect application behavior data, and the collected data is cleaned and format converted using Python's Pandas library.

[0012] Furthermore, in the fusion multimodal deep learning detection model, the CNN model has 3 convolutional layers and 2 pooling layers for traffic feature extraction, and the RNN / LSTM model has 2 LSTM layers for behavior feature extraction. A late fusion method is adopted, where the outputs of the CNN and RNN / LSTM models are concatenated after passing through fully connected layers, and then classified through a Softmax layer. During training, the learning rate is set to 0.001, the number of training epochs is 100, and the model is evaluated using a validation set to prevent overfitting.

[0013] Furthermore, in the real-time behavior pattern evolution analysis module, the number and type of detected intrusion behaviors are counted every 5 minutes. The moving average method and autoregressive integral moving average model (ARIMA) in Python's Statsmodels library are used to analyze the time series data of intrusion behaviors. An intelligent decision-making model is built based on deep Q network (DQN), taking the detected behavior patterns and early warning signals as state inputs and the operation of adjusting the detection model parameters as action outputs. A reward mechanism is set to learn the optimal parameter adjustment strategy.

[0014] Furthermore, the dynamic deception defense module pre-prepares a series of deception decoy templates. When an intrusion is detected, a corresponding deception decoy is generated from the templates according to the type of intrusion. A virtual honeynet environment is constructed using virtualization technology, and virtual hosts, network topology, and services in the honeynet are configured to simulate a real network environment. Attacker traffic is redirected to the honeynet through IPtables rules or a software-defined networking (SDN) controller. Monitoring tools in the honeynet are activated to record attacker operations, and the deception defense strategy is adjusted in real time based on the analysis results of the attacker's behavior in the honeynet.

[0015] Furthermore, an adaptive network intrusion detection and proactive defense method based on multimodal deep learning is proposed, characterized by the following steps: S1. Collect data from multiple modalities, such as network traffic data, host system logs, and application behavior data, and perform cleaning and preprocessing. S2. Use convolutional neural networks (CNN) to extract traffic features from network traffic data, and use recurrent neural networks (RNN) and their variant Long Short-Term Memory (LSTM) networks to extract time series features from host system logs and application behavior data. Combine the features of both and train a fusion multimodal deep learning detection model. S3. Based on the trained model, monitor network behavior and host behavior in real time, use time series analysis technology to track the evolution of behavior patterns, and use reinforcement learning algorithms to adjust the detection model parameters; S4. When an intrusion is detected, generate a corresponding deception decoy, construct a virtual honeynet environment to redirect the attacker into it, and adjust the deception defense strategy in real time.

[0016] Furthermore, in the data collection step, the network probe is set to a sampling frequency of 100 packets per second to capture network traffic data, the host system log file is read periodically through the operating system log interface and converted into a structured format, code is embedded in the application to collect application behavior data, and the Pandas library of Python is used for data cleaning and format conversion.

[0017] Furthermore, in the training step of the multimodal deep learning detection model, the CNN model has 3 convolutional layers and 2 pooling layers, and the RNN / LSTM model has 2 LSTM layers. A late fusion method is adopted, the learning rate is set to 0.001 during training, the number of training rounds is 100, and the model is evaluated using a validation set to prevent overfitting.

[0018] Furthermore, in the real-time monitoring and model parameter adjustment steps, the number and type of intrusion behaviors are counted every 5 minutes. The moving average method and ARIMA model in Python's Statsmodels library are used to analyze time series data. An intelligent decision-making model is built based on a deep Q-network (DQN), and a reward mechanism is set to learn the optimal parameter adjustment strategy.

[0019] Furthermore, in the dynamic deception defense process, deception bait templates are prepared in advance, corresponding baits are generated according to the type of intrusion behavior, a virtual honeynet environment is built using virtualization technology, attacker traffic is redirected through IPtables rules or SDN controllers, monitoring tools are started to record attacker operations, and deception defense strategies are adjusted in real time based on the behavioral analysis results.

[0020] The technical effects and advantages of this invention are as follows: 1. This invention employs a multimodal data acquisition module and a fusion multimodal deep learning detection model, resulting in a significant improvement in detection accuracy. The multimodal data acquisition module extensively collects data from various sources, including network traffic data, host system logs, and application behavior data, comprehensively covering all aspects of network operation. Subsequently, the fusion multimodal deep learning detection model utilizes convolutional neural networks (CNNs) to extract deep features from network traffic data, accurately capturing local features such as packet size distribution patterns and traffic change trends at specific ports through sliding convolution kernels of different sizes. Recurrent neural networks (RNNs) and their variant, Long Short-Term Memory (LSTM) networks, are used to model time-series features of host system logs and application behavior data, effectively grasping the time dependencies of behaviors such as process startup order and system call intervals. Finally, the features from both are fused, greatly enriching the model's learnable feature dimensions. Compared to traditional detection systems based on a single feature library or single-dimensional analysis, this significantly improves the detection capability for various intrusion behaviors, especially novel and unknown attacks, comprehensively enhancing the adaptability of the network security protection system to complex attack scenarios.

[0021] 2. This invention, through the inclusion of a real-time behavior pattern evolution analysis module and a dynamic deception defense module, achieves a leap in real-time response and proactive defense capabilities. The real-time behavior pattern evolution analysis module, based on a pre-trained fusion model, can monitor network and host behavior in real-time within a real-world network environment. It automatically counts the number and type of intrusion behaviors every 5 minutes, generating time-series data, and uses the moving average method and Autoregressive Integral Moving Average (ARIMA) model from Python's Statsmodels library to accurately track the evolution of behavior patterns, promptly detecting abnormal changes and issuing early warning signals. Simultaneously, an intelligent decision-making model built based on Deep Q-Network (DQN) automatically adjusts the detection model parameters according to the real-time monitored behavior patterns and early warning signals, enabling the system to quickly adapt to the constantly changing network attack environment. The dynamic deception defense module immediately activates its defense mechanism upon detecting intrusion behavior. A rich set of pre-prepared deception bait templates can generate realistic baits based on the intrusion type, such as generating highly realistic sensitive file baits for file theft attacks. A virtual honeycomb environment built using virtualization technology can redirect attackers within it, and precise traffic redirection can be achieved through IPtables rules or SDN controllers. The monitoring tools within the honeynet comprehensively record attacker actions, and the system adjusts its deception defense strategies in real time based on behavioral analysis results. This real-time response and proactive defense mechanism effectively combats complex attacks such as Advanced Persistent Threat (APT) attack chains, greatly reducing the likelihood of attackers causing substantial damage to the network system.

[0022] 3. This invention significantly reduces resource consumption by optimizing the overall architecture and data processing methods. Unlike detection systems based on full traffic mirroring, the multimodal data acquisition module of this invention does not blindly collect all data. Instead, it strategically deploys network probes at key network nodes, such as core switches, firewall egress points, and aggregation nodes of various departmental subnets, setting a sampling frequency of 100 data packets per second. This ensures sufficient traffic information for analysis while avoiding excessive load on the network probes due to excessively high sampling frequencies. Efficient and targeted techniques are also employed in log processing and application data acquisition. During data processing, Python's Pandas library is used for cleaning and format conversion, avoiding the processing of redundant data. This optimized data acquisition and processing method significantly reduces network operating costs and minimizes the impact on network performance while ensuring detection effectiveness, thus guaranteeing the stable operation of normal business operations. Attached Figure Description

[0023] Figure 1 This is a system architecture diagram of the present invention.

[0024] Figure 2 This is a flowchart of the method of the present invention. Detailed Implementation

[0025] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] Example 1: like Figure 1 As shown, this invention provides a computer network intrusion detection and prevention system that combines artificial intelligence, the core architecture of which consists of the following key modules: Multimodal Data Acquisition Module: This module is responsible for collecting multimodal data from multiple data sources, including network traffic data, host system logs, and application behavior data. For network traffic data acquisition, specialized network probe devices are deployed at key network nodes, such as core switches and firewall egress points. These probes capture network packets in real time, with a sampling frequency of 100 packets per second to ensure representative network traffic samples are obtained. For host system logs, appropriate log interfaces are used depending on the operating system type. For example, for Windows systems, the Windows Event Log interface is used; for Linux systems, the host system log files are read periodically via the syslog protocol. Custom scripts are then written, using text processing techniques such as regular expressions to convert the log data into a structured format for easier subsequent analysis. For application behavior data acquisition, collaboration with the application development team is used to embed specific data acquisition code into the application code. For example, in web applications, JavaScript scripts are used to listen for user actions such as clicks, input, and page navigation, and this behavioral data is sent to a dedicated data acquisition server via HTTP requests. The collected data usually contains noisy and duplicate data. By utilizing the powerful data processing capabilities of Python's Pandas library, duplicate data is removed using deduplication functions, and noisy data is identified and eliminated using data cleaning algorithms. Data of different formats is then uniformly converted into CSV format for subsequent processing.

[0027] A multimodal deep learning detection model is implemented: Convolutional Neural Networks (CNNs) are used to extract deep features from network traffic data. The constructed CNN model has three convolutional layers and two pooling layers. The convolutional layers slide across the network traffic data using convolutional kernels of different sizes, automatically learning local features in the traffic data, such as the distribution pattern of packet size and the traffic change trend of specific ports. The pooling layers downsample the output of the convolutional layers, retaining the main features while reducing the amount of data. For host system logs and application behavior data, recurrent neural networks (RNNs) and their variant, Long Short-Term Memory (LSTM) networks, are used for time series feature modeling. The LSTM model has two layers and can effectively capture the temporal dependencies in the behavior data, such as the order of process startup and the time interval of system calls. A late fusion mechanism is designed, where the traffic features extracted by the CNN and the behavior features extracted by the RNN / LSTM are respectively transformed in dimension by fully connected layers and then concatenated. Finally, a softmax layer is used for classification, outputting the probability that the behavior is normal or intrusive. The fusion model was trained using a large amount of known normal and abnormal data. The training dataset was collected and labeled from publicly available cybersecurity datasets and real-world network environments. During training, the cross-entropy loss function was used to measure the difference between the model's predictions and the true labels. The stochastic gradient descent optimization algorithm was used, with a learning rate of 0.001, and the model was trained iteratively for 100 epochs. At the same time, the model was evaluated using a validation set, and the model parameters were dynamically adjusted to prevent overfitting.

[0028] The real-time behavior pattern evolution analysis module, based on a pre-trained fusion multimodal deep learning detection model, monitors network and host behavior in real-time within a real-world network environment. Every 5 minutes, the system automatically counts the number and type of detected intrusion behaviors, generating time-series data. It uses the moving average method from Python's Statsmodels library to smooth short-term behavior pattern changes, while combining it with an autoregressive integral moving average (ARIMA) model to predict long-term trends. An intelligent decision-making model is built based on a deep Q-network (DQN). Detected behavior patterns and warning signals are input as state information to the DQN model, while adjustments to the detection model parameters, such as changing the convolutional kernel size or adjusting the number of neurons in the LSTM layer, are output as actions. A reward mechanism is implemented: positive rewards are given when detection accuracy improves or the number of intrusion behaviors decreases; conversely, negative rewards are given. Through continuous interaction with the environment, the DQN model learns the optimal parameter adjustment strategy to adapt to the constantly changing network attack environment.

[0029] Dynamic Deception Defense Module: Upon detecting intrusion, the system immediately activates a dynamic deception defense mechanism. A rich set of deception bait templates is prepared in advance, covering different types of files, accounts, and services. For example, against file theft attacks, seemingly realistic sensitive file baits are prepared, simulating real sensitive files in terms of name, format, and content structure; for account intrusion attacks, fake user accounts are generated with different permissions and login records. When an intrusion is detected, a specific deception bait is generated from the corresponding template based on the type of intrusion. Virtualization technologies, such as VMware or KVM, are used to construct a virtual honeycomb environment. Virtual hosts are carefully configured within the honeycomb to simulate various server roles in a real network, such as web servers, database servers, and mail servers, and corresponding network topologies are built, with different network zones and access control policies set. Using IPtables rules, in a Linux system environment, attacker traffic is redirected to the honeycomb; in a network environment supporting Software-Defined Networking (SDN), the SDN controller is used to achieve precise traffic redirection. Activate monitoring tools within the honeynet, such as Snort Intrusion Detection System and Suricata, to comprehensively record attacker activities within the honeynet, including file access paths, executed commands, and attempted connection ports. Based on the analysis of attacker behavior within the honeynet, adjust deception defense strategies in real time, such as adding new deception lures or altering the honeynet's network topology, ensuring that attackers are constantly deceived and monitored.

[0030] Example 2 The difference between Example 2 and Example 1 is that the specific implementation details and technology selections of each module are more clearly quantified.

[0031] Multimodal data acquisition module: The specific locations of network probes deployed at key network nodes are determined based on the network topology and traffic analysis requirements. For example, in large enterprise networks, in addition to core switches and firewall egress points, probes are also deployed at aggregation nodes in various departmental subnets to more accurately locate the source of abnormal traffic. Setting the sampling frequency to 100 packets per second was based on prior testing, ensuring sufficient traffic information is obtained while avoiding excessive load on the network probes due to excessively high sampling frequencies. Regarding log processing, specialized log parsing scripts were developed to address the differences in log formats across different operating systems. For example, for Windows event logs, PowerShell scripts combined with XML parsing technology are used to convert complex event log data into structured table formats; for Linux system syslog logs, Python log parsing libraries, such as logging-config-reader, are used to efficiently extract key information and convert it into a structured format. During the embedding of application data acquisition code, application development specifications and security principles are followed to ensure that the data acquisition code does not affect the normal operation and security of the application. When using Python's Pandas library for data cleaning and format conversion, leverage Pandas' functional programming features, such as the apply function and lambda expressions, to efficiently perform data cleaning and format conversion operations.

[0032] The system integrates multimodal deep learning detection models: In CNN model construction, specific kernel sizes and strides are selected, such as using a 3x3 kernel with a stride of 1 in the first convolutional layer, to fully extract local detail features from the traffic data. In RNN / LSTM models, specific algorithms, such as the Xavier initialization method, are used to initialize the weights of the input, forget, and output gates of the LSTM layer to accelerate model convergence. In late-stage fusion, the feature vectors output by the CNN and RNN / LSTM models are standardized to concatenate different features at the same scale, improving classification accuracy. During model training, GPU acceleration technologies, such as NVIDIA's CUDA toolkit, are used to significantly shorten training time. When evaluating the model using a validation set, multiple evaluation metrics, such as accuracy, recall, and F1 score, are employed to comprehensively assess model performance. The learning rate and number of training epochs are dynamically adjusted based on the evaluation results to further optimize the model.

[0033] The real-time behavior pattern evolution analysis module utilizes database technologies such as MySQL or MongoDB to store historical behavior data when statistically analyzing the number and types of intrusion behaviors, enabling more in-depth data analysis and trend prediction. When performing time series analysis using Python's Statsmodels library, the parameters of the ARIMA model are fine-tuned, and the optimal combination of p, d, and q parameters is found through a grid search algorithm to improve prediction accuracy. When building an intelligent decision-making model based on a Deep Q-Network (DQN), an experience replay mechanism is employed. Information such as the state, actions, rewards, and next state generated by the intelligent decision-making model's interaction with the environment is stored in an experience replay pool. Randomly selected samples are used for training, reducing the correlation between data and improving the model's stability and generalization ability.

[0034] Dynamic Deception Defense Module: When preparing deception bait templates, data mining techniques are used to extract features from real network and business data to generate more realistic deception baits. For example, by analyzing the naming rules, content structure, and access frequency of internal enterprise files, highly deceptive file baits are generated. When constructing the virtual honeynet environment, common vulnerabilities and weaknesses in real networks are simulated, such as setting up a web server version with known security vulnerabilities to attract attackers to conduct in-depth attacks, in order to better understand the attacker's methods and objectives. When redirecting attacker traffic, network traffic shaping techniques, such as TrafficShaping, are used to control the rate of attacker traffic within the honeynet, preventing excessive traffic from affecting the normal operation of the honeynet. When monitoring attacker operations, big data analytics techniques, such as Hadoop and Spark, are combined to perform real-time analysis of massive amounts of monitoring data, quickly discovering attacker behavior patterns and attack intentions.

[0035] Example 3 like Figure 2 As shown in the figure, this embodiment provides an adaptive network intrusion detection and proactive defense method based on multimodal deep learning, the specific steps of which are as follows: S1. Collect data from multiple modalities, including network traffic data, host system logs, and application behavior data, and perform cleaning and preprocessing: In the network traffic data collection phase, professional network traffic collection tools, such as Wireshark or Tcpdump, are used. Collection devices are deployed at key network nodes based on the network topology and business needs. By configuring collection parameters, such as setting packet capture filters, only packets from specific protocols and IP address ranges are captured, improving collection efficiency. For host system log collection, different log collection tools and methods are used for different operating systems. For Windows systems, Windows Management Instrumentation (WMI) technology is used to write PowerShell scripts to periodically obtain system logs; for Linux systems, the syslog service is configured to send logs to a designated log server for centralized management. For application behavior data collection, different collection methods are used for different types of applications. For example, for mobile applications, the SDK provided by the mobile application development platform is used to integrate data collection functionality; for desktop applications, hook functions and other technologies are used to monitor user actions. The collected data is cleaned and preprocessed using Python's Pandas library. First, use data visualization tools such as Matplotlib or Seaborn to perform preliminary data analysis, identifying potential noisy data and outliers. Then, use Pandas functions for data cleaning, such as the `dropna` function to remove records with missing values ​​and the `replace` function to replace outliers. Finally, convert the data from different formats to a unified DataFrame format for easier subsequent processing.

[0036] S2. Utilize Convolutional Neural Networks (CNNs) to extract traffic features from network traffic data, and Recurrent Neural Networks (RNNs) and their variant, Long Short-Term Memory (LSTM) networks, to extract time-series features from host system logs and application behavior data. Fuse these features and train a fusion multimodal deep learning detection model. In building the CNN model, choose a suitable deep learning framework, such as TensorFlow or PyTorch. Taking TensorFlow as an example, use the Keras API to build the CNN model, defining the input layer, convolutional layers, pooling layers, and fully connected layers. When defining the convolutional layers, set parameters such as the size, number, and stride of the convolutional kernels, for example, using 32 3x3 convolutional kernels with a stride of 1, and selecting ReLU as the activation function. In building the RNN / LSTM model, also use TensorFlow's Keras API to define parameters such as the number of neurons and the number of layers in the LSTM layer, for example, building a 2-layer LSTM model with 128 neurons. When fusing the features of both models, a late-stage fusion approach is adopted. The outputs of the CNN model and the RNN / LSTM model are concatenated after passing through fully connected layers, and then classified using a softmax layer. During model training, a large training dataset is prepared, including normal behavior data and intrusion behavior data. Data preprocessing is performed, such as normalizing network traffic data and encoding host system logs and application behavior data. Training parameters are set, such as a learning rate of 0.001 and 100 training epochs. The Adam optimizer is used for model training, and a validation set is used to evaluate model performance and prevent overfitting.

[0037] S3. Based on a trained model, real-time monitoring of network and host behavior is conducted. Time series analysis is used to track the evolution of behavioral patterns, and reinforcement learning algorithms are employed to adjust the detection model parameters. During the real-time monitoring phase, the trained multimodal deep learning detection model is deployed to the actual network environment. Network traffic data, host system logs, and application behavior data are acquired in real time through network interfaces. This data is input into the model to obtain behavioral predictions. Every 5 minutes, the number and type of detected intrusion behaviors are statistically analyzed to generate time series data. The moving average method and autoregressive integral moving average (ARIMA) model from Python's Statsmodels library are used to analyze the time series data and predict future trends in behavioral patterns. An intelligent decision-making model is constructed based on a deep Q-network (DQN). Detected behavioral patterns and warning signals are input as states into the DQN model, and adjustments to the detection model parameters are output as actions. A reward mechanism is implemented: positive rewards are given when the model's detection accuracy improves or the number of intrusion behaviors decreases; conversely, negative rewards are given. By continuously interacting with the environment, the DQN model learns the optimal parameter adjustment strategy, dynamically adjusts the parameters of the detection model, and improves the model's detection performance.

[0038] S4. When an intrusion is detected, a corresponding deception decoy is generated, and a virtual honeynet environment is constructed to redirect the attacker within it. The deception defense strategy is adjusted in real time: When an intrusion is detected, a corresponding template is selected from a pre-prepared deception decoy template library to generate a deception decoy based on the type of intrusion. For example, if an attacker is detected attempting to steal sensitive files, a fake file with a similar name, format, and content structure is generated from the file decoy template library. Virtualization technologies, such as VMware or KVM, are used to construct a virtual honeynet environment. During honeynet construction, the operating system of the virtual host is configured, and common applications and services are installed to simulate a real network environment. Attacker traffic is redirected to the honeynet through IPtables rules or a software-defined networking (SDN) controller. Monitoring tools, such as Snort intrusion detection systems and Suricata, are deployed in the honeynet to record attacker behavior in real time. Based on the analysis results of attacker behavior within the honeynet, the deception defense strategy is adjusted in real time. For example, if attackers are found to be more interested in a certain type of file, increase the quantity and attractiveness of that type of fake file; if attackers are found to be attempting to bypass the honeynet's restrictions, adjust the honeynet's access control policies and topology to make it more complex and difficult to breach.

[0039] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A computer network intrusion detection and prevention system incorporating artificial intelligence, comprising, characterized in that: The multimodal data acquisition module is used to collect data of various modalities such as network traffic data, host system logs, and application behavior data. It also performs preliminary cleaning and preprocessing on the collected data to remove noisy and duplicate data and convert data of different formats into a unified processable format. This paper integrates a multimodal deep learning detection model. Convolutional Neural Networks (CNNs) are used to extract traffic features from network traffic data, and Recurrent Neural Networks (RNNs) and their variant Long Short-Term Memory Networks (LSTMs) are used to model time series features from host system logs and application behavior data. A fusion mechanism is designed to combine the traffic features extracted by CNNs and the behavioral features extracted by RNNs / LSTMs. The fusion model is trained using a large amount of known normal and abnormal data, and optimization algorithms such as cross-entropy loss function and stochastic gradient descent are used to adjust the model parameters. The real-time behavior pattern evolution analysis module, based on a trained fusion multimodal deep learning detection model, monitors network behavior and host behavior in real time, tracks the evolution of behavior patterns using time series analysis technology, and automatically adjusts the parameters of the detection model based on the real-time monitored behavior patterns and early warning signals using reinforcement learning algorithms. The dynamic deception defense module automatically generates corresponding deception baits based on the type and characteristics of intrusion behavior when it detects an intrusion, constructs a virtual honeycomb environment, redirects attackers to the honeycomb, and adjusts the deception defense strategy in real time.

2. The computer network intrusion detection and prevention system combining artificial intelligence according to claim 1, characterized in that: In the multimodal data acquisition module, network probes are deployed at key network nodes, and the sampling frequency is set to 100 data packets per second to capture network traffic data; The system log files are read periodically through the operating system log interface, and the log data is converted into a structured format using a script. Data collection code is embedded in the application to collect application behavior data, and the collected data is cleaned and formatted using Python's Pandas library.

3. The computer network intrusion detection and prevention system combining artificial intelligence according to claim 1, characterized in that: In the fusion multimodal deep learning detection model, the CNN model has 3 convolutional layers and 2 pooling layers for traffic feature extraction, and the RNN / LSTM model has 2 LSTM layers for behavior feature extraction. A late fusion method is adopted, in which the outputs of the CNN and RNN / LSTM models are concatenated after passing through fully connected layers, and then classified through a Softmax layer. During training, the learning rate is set to 0.001, the number of training epochs is 100, and the model is evaluated using a validation set to prevent overfitting.

4. The computer network intrusion detection and prevention system combining artificial intelligence according to claim 1, characterized in that: In the real-time behavior pattern evolution analysis module, the number and type of detected intrusion behaviors are counted every 5 minutes. The moving average method and autoregressive integral moving average model (ARIMA) in Python's Statsmodels library are used to analyze the time series data of intrusion behaviors. An intelligent decision-making model is built based on deep Q network (DQN). The detected behavior patterns and early warning signals are used as state inputs, and the operation of adjusting the detection model parameters is used as action outputs. A reward mechanism is set to learn the optimal parameter adjustment strategy.

5. The computer network intrusion detection and prevention system combining artificial intelligence according to claim 1, characterized in that: In the dynamic deception defense module, a series of deception decoy templates are prepared in advance. When an intrusion behavior is detected, a corresponding deception decoy is generated from the templates according to the type of intrusion behavior. Virtualization technology is used to build a virtual honeynet environment, and virtual hosts, network topology and services in the honeynet are configured to simulate the real network environment. Attacker traffic is redirected to the honeynet through IPtables rules or software-defined networking (SDN) controllers. Monitoring tools in the honeynet are started to record attacker operations, and deception defense strategies are adjusted in real time based on the analysis results of attacker behavior in the honeynet.

6. An adaptive network intrusion detection and proactive defense method based on multimodal deep learning, characterized in that, Includes the following steps: S1. Collect data from multiple modalities, such as network traffic data, host system logs, and application behavior data, and perform cleaning and preprocessing. S2. Use convolutional neural networks (CNN) to extract traffic features from network traffic data, and use recurrent neural networks (RNN) and their variant Long Short-Term Memory (LSTM) networks to extract time series features from host system logs and application behavior data. Combine the features of both and train a fusion multimodal deep learning detection model. S3. Based on the trained model, monitor network behavior and host behavior in real time, use time series analysis technology to track the evolution of behavior patterns, and use reinforcement learning algorithms to adjust the detection model parameters; S4. When an intrusion is detected, generate a corresponding deception decoy, construct a virtual honeynet environment to redirect the attacker into it, and adjust the deception defense strategy in real time.

7. The adaptive network intrusion detection and proactive defense method based on multimodal deep learning according to claim 6, characterized in that, In the data collection step, the network probe is set to a sampling frequency of 100 packets per second to capture network traffic data. It periodically reads the host system log file through the operating system log interface and converts it into a structured format. It also embeds code in the application to collect application behavior data and uses Python's Pandas library for data cleaning and format conversion.

8. The adaptive network intrusion detection and proactive defense method based on multimodal deep learning according to claim 6, characterized in that, In the training step of the multimodal deep learning detection model, the CNN model has 3 convolutional layers and 2 pooling layers, and the RNN / LSTM model has 2 LSTM layers. The late fusion method is adopted, the learning rate is set to 0.001 during training, the number of training rounds is 100, and the model is evaluated using a validation set to prevent overfitting.

9. The adaptive network intrusion detection and proactive defense method based on multimodal deep learning according to claim 6, characterized in that, In the real-time monitoring and model parameter adjustment process, the number and type of intrusion behaviors are counted every 5 minutes. The moving average method and ARIMA model in Python's Statsmodels library are used to analyze time series data. An intelligent decision-making model is built based on a deep Q-network (DQN), and a reward mechanism is set to learn the optimal parameter adjustment strategy.

10. The adaptive network intrusion detection and proactive defense method based on multimodal deep learning according to claim 6, characterized in that, In the dynamic deception defense process, deception bait templates are prepared in advance, corresponding baits are generated according to the type of intrusion behavior, a virtual honeynet environment is built using virtualization technology, attacker traffic is redirected through IPtables rules or SDN controllers, monitoring tools are started to record attacker operations, and deception defense strategies are adjusted in real time based on the behavioral analysis results.

Images